{"page":"/blog/pharma-programmatic-advertising","modified":"2026-11-10","license":"https://creativecommons.org/licenses/by/4.0/","columns":["Data source","What it is","Rules that apply","Facts that change the answer"],"rows":[["Contextual","Bids based on page or app content, keywords or the current visit; no user history","FDA content rules (202.1); platform drug-ad policies. DAA principles exclude contextual ads (DAA OBA)","A pixel on the landing page collects user data; a \"contextual\" segment built from past browsing is behavioral, not contextual"],["Endemic health sites","Placements on health publishers, bought directly, through a private marketplace or by site list","FDA content rules; platform policies; state consumer health data law if the publisher's user-level data is used (RCW 19.373.010(8)); NAI Principle 4 for members","Buying the page is contextual; buying the publisher's audience of readers of a condition page uses inferred health data, which Washington counts as consumer health data"],["HCP NPI targeting","Reaching prescribers by National Provider Identifier, matched to emails or devices by a data partner","FDA content rules for professional promotion (see the Lundbeck and AbbVie letters above); NPI registry data is published by CMS (NPPES files, 9 November 2026); Sorrell v. IMS Health, 564 U.S. 552 (2011) struck down a state limit on prescriber data for marketing","Prescribing-volume scores built from patient claims depend on how the claims were de-identified (164.514); Washington's MHMDA excludes people \"acting in an employment context\""],["Consumer health condition audiences","Segments of people inferred to have a condition, from browsing, purchases, location or models","FTC Act Section 5; state consumer health data laws, including inferred data (RCW 19.373.010(8)(b)(xiii), 19.373.030); DAA VI.B for prescriptions and medical records; NAI Principle 4; Google and Meta restrictions","If the segment comes from PHI, HIPAA governs its source; if a covered entity built it, the output must be de-identified or authorized"],["Clean-room matches with pharmacies","Manufacturer data or ad exposure matched to pharmacy data inside a clean room for targeting or measurement","HIPAA for the pharmacy: marketing authorization if paid (164.508(a)(3)), sale of PHI (164.502(a)(5)(ii)), de-identified outputs (164.514); a BAA with the clean-room operator if it handles PHI (164.504(e)); state law for front-store data","Whether prescription records enter the room; whether outputs are row-level or aggregate; who pays whom. CVS Media Exchange states it uses front-store loyalty data (CMX)"]],"sourceUrls":[["https://www.ecfr.gov/current/title-21/chapter-I/subchapter-C/part-202/section-202.1","https://digitaladvertisingalliance.org/sites/aboutads/files/DAA_files/seven-principles-07-01-09.pdf"],["https://app.leg.wa.gov/RCW/default.aspx?cite=19.373.010"],["https://download.cms.gov/nppes/NPI_Files.html","https://www.law.cornell.edu/supremecourt/text/10-779","https://www.ecfr.gov/current/title-45/section-164.514"],["https://app.leg.wa.gov/RCW/default.aspx?cite=19.373.010","https://app.leg.wa.gov/RCW/default.aspx?cite=19.373.030"],["https://www.ecfr.gov/current/title-45/section-164.508","https://www.ecfr.gov/current/title-45/section-164.502","https://www.ecfr.gov/current/title-45/section-164.514","https://www.ecfr.gov/current/title-45/section-164.504","https://www.cvsmediaexchange.com/"]]}